Ds facebook page has been hacked, it looks like he has sent a link to everyone he is friends with but it's not him doing it, I've reported it to FB, does he have to also report it? Dh said that he will have to close the account and start again, does he have to do this or just change his password?
It hasn't been hacked in the way you think. It's just a bot.
If the a sexual link or a capital letters SHOCK stepfather records stepdaughter and see what happens next crap (that she would have clicked on herself to get infected) then Facebook will ban her account themselves probably.